Nginx access log

edenho

今日行左個 nginx engine 放左出公海, 夜晚返黎見到個access log 有依三句唔正常既log，有冇師兄知係代表乜，係米有人 hack

daitau

Have you enabled https on your server? The first 2 look like someone trying to talk to your plain http server with https.
The third one looks normal.

9412

三個都冇UA大多數都唔會係咩好野
放得出公海就預左比bot scan下, 撞下有冇phpmyadmin咁

edenho

冇用 HTTPS

回覆 2# daitau

Ferrari2010

冇用 HTTPS

回覆  daitau
edenho 發表於 2020-3-24 07:56

因為正常用browser開http://<ip or domain> 係會駁去port 80, 除非你自己port forward左443去80, 否則佢地會入唔到你server. 因為443冇open.

但如果logs睇到佢地以tls protocol 連接你的port 80, 通常就唔係一般人用browser上網的行為.
所以可以斷定, 佢地係用web crawler 或者 port scan去試你server. 但因為tls handshake失敗, 所以頭兩個基本上冇事發生. 至於第三個, 佢只係掃一掃root就走, 冇行下d well known vulnerable path, 照睇佢就唔係vulnerability scanner.

edenho

個 nginx 我改左 port number  唔係用 default, 而 router 都只係開左兩個 port forwarding 。一個比 Vpn, 一個比 nginx service 。

希望咁樣安全啲。

回覆 5# Ferrari2010

Ferrari2010

個 nginx 我改左 port number  唔係用 default, 而 router 都只係開左兩個 port forwarding 。一個比 Vpn,  ...
edenho 發表於 2020-3-24 13:32

點解唔經vpn返屋企先access個nginx.
有content要放出街比其他人?

edenho

先頭自己用都係 vpn 返屋企，依家想分享比其他人，所以先要放出去。

回覆 7# Ferrari2010